ssh-agent: improve handling of SSH_AUTH_SOCK variable

Specifically, only preserve `$SSH_AUTH_SOCK` when it points to a
forwarded agent.

modules/services/ssh-agent.nix

@@ -57,29 +57,31 @@ in
               else
                 "$XDG_RUNTIME_DIR/${cfg.socket}";
 
+            # Preserve $SSH_AUTH_SOCK only if it stems from a forwarded agent,
+            # which is the case if both $SSH_AUTH_SOCK and $SSH_CONNECTION are
+            # set.
             bashIntegration = ''
-              if [ -z "$SSH_AUTH_SOCK" ]; then
+              if [ -z "$SSH_AUTH_SOCK" -o -z "$SSH_CONNECTION" ]; then
                 export SSH_AUTH_SOCK=${socketPath}
               fi
             '';
-
             fishIntegration = ''
-              if test -z "$SSH_AUTH_SOCK"
+              if test -z "$SSH_AUTH_SOCK"; or test -z "$SSH_CONNECTION"
                 set -x SSH_AUTH_SOCK ${socketPath}
               end
             '';
-
             nushellIntegration =
+              let
+                unsetOrEmpty = var: ''("${var}" not-in $env) or ($env.${var} | is-empty)'';
+                socketPath =
                   if pkgs.stdenv.isDarwin then
-                ''
-                  if "SSH_AUTH_SOCK" not-in $env {
-                    $env.SSH_AUTH_SOCK = $"(${lib.getExe pkgs.getconf} DARWIN_USER_TEMP_DIR)/${cfg.socket}"
-                  }
-                ''
+                    ''$"(${lib.getExe pkgs.getconf} DARWIN_USER_TEMP_DIR)/${cfg.socket}"''
                   else
+                    ''$"($env.XDG_RUNTIME_DIR)/${cfg.socket}"'';
+              in
               ''
-                  if "SSH_AUTH_SOCK" not-in $env {
-                    $env.SSH_AUTH_SOCK = $"($env.XDG_RUNTIME_DIR)/${cfg.socket}"
+                if ${unsetOrEmpty "SSH_AUTH_SOCK"} or ${unsetOrEmpty "SSH_CONNECTION"} {
+                  $env.SSH_AUTH_SOCK = ${socketPath}
                 }
               '';
           in